Showing posts with label OIT. Show all posts
Showing posts with label OIT. Show all posts

News Release: Colorado.gov State Web Portal Homepage Resumes Normal Operation After Cybersecurity Incident

Oct. 6 - DENVER - The Colorado.gov State Web Portal homepage that was taken offline yesterday due to a cybersecurity incident has resumed normal operation. All other Colorado.gov websites and essential state government services were unaffected by the cyber event and continue to be available.

The Governor’s Office of Information Technology (OIT) and State Emergency Operations Center worked with the Statewide Internet Portal Authority (SIPA) and their vendor partner - who together manage Colorado.gov websites - to restore access to the Portal homepage at 6 p.m. today.

While only the Colorado.gov homepage was impacted by the event, OIT, SIPA and their vendor partner will continue to actively monitor state websites and systems. This cybersecurity incident is part of an ongoing investigation in collaboration with state and federal partners. No further details are available at this time due to the sensitivity and nature of the cyber event.


###

Colorado DHSEM Committed to Being a Good Steward of Public Funds



news release image

On December 10, 2015 the U. S. Department of Homeland Security’s Office of Inspector General (OIG) issued the OIG-16-13 Report: Oversight of the Colorado Emergency Management Performance Grant Program Needs Improvement. This program is managed by the Colorado Division of Homeland Security and Emergency Management (DHSEM). The OIG made five recommendations. The Colorado DHSEM is committed to being a good steward of public funds and our desire to improve our systems.

DHSEM believes OIG should acknowledge that during their audit, DHSEM was still understaffed, dealing with the massive volume of recovery work from the catastrophic flood disaster of 2013, (4145-DR-CO), was dealing with new flooding, was activated for storms and associated flooding, and received a new Stafford Act Disaster Declaration for storms, tornadoes, and flooding (4229-DR-CO), thus the delays were capacity challenges and work volume; not intentional acts to impair the OIG’s work.


The findings and the DHSEM response are listed below:

OIG Recommendation #1: We recommend that the Acting Regional Administrator – FEMA Region VIII, remedy the $457, 895 in unsupported costs.

DHSEM Response to Recommendation #1: DHSEM believes adequate documentation exists for the questioned transactions and has met with the FEMA Region VIII financial staff. Further, the OIG findings and recommendations are not consistent with findings and recommendations during FEMA Region VIII annual monitoring visits nor do they reflect the Division’s actions taken to remedy known accounting errors in the State of Colorado’s new financial services system.

DHSEM provided documentation identifying the questioned funds as coding errors with 75% related to payroll that were created as the State transitioned to a new financial system. The payroll coding errors could not be addressed due to the inability to modify payroll allocations in the new system until June 2015. DHSEM completed these processes as part of the State 2015 Fiscal Year closeout. DHSEM mitigated these errors by maintaining records of each of these transactions and supporting documentation of transactions needing correction in the new financial system and its associated General Ledger.

The remaining funds were related to fleet or IT equipment. DHSEM maintains all Department and Division vehicle order and purchase authorization documentation from our transactions with State Central Fleet; however, the actual lease is between the dealership and State Central Fleet and is maintained at the State Central Fleet Office. DHSEM reiterates that it maintains adequate supporting documentation and its commitment to launching a document control system to improve ease of access to supporting documentation. The IT equipment is also purchased through the IT division and documentation is maintained with that program.

OIG Recommendation #2: We recommend that the Acting Regional Administrator - FEMA Region VIII, ensure the DHSEM implements improved financial controls so that all future grant expenditures are accounted for accurately and timely, and that future financial reports submitted to FEMA are complete and accurate.

DHSEM Response to Recommendation #2: DHSEM agrees to work with FEMA Region VIII to implement further financial control improvements. As documented, DHSEM already instituted some improvements and the State provided additional capability in the financial system for journal entries, ensuring future entries can be made during the performance and grant reporting periods. DHSEM is committed to submitting future FFRs timely, complete and accurate.

That being said, DHSEM agrees that lack of sufficient staff and consistent monitoring tools had an adverse impact on subrecipient monitoring. Finally, the Division made progress on addressing staffing shortages. In December 2013, the number of staff in the Finance Section was two permanent employees and three temporary contractors. Today the Finance Section has ten permanent employees.

OIG Recommendation #3: We recommend that the Acting Regional Administrator – FEMA Region VIII, require DHSEM to improve its process and controls for retaining source documents of all EMPG expenditures.

DHSEM Response to Recommendation #3: DHSEM maintains that it complies with the source documentation criteria cited in 44 CFR § 13.20b(6), but agrees that improvements should be made. DHSEM looks forward to FEMA Region VIII’s recommendations for improving process and controls for retaining source documents of all EMPG expenditures. In addition, DHSEM currently is reviewing options for a new document control system. DHSEM does not agree to maintain source documents of all EMPG expenditures that are the property and responsibility of the subrecipient; however, DHSEM does agree to require and review subrecipient retention of these documents.

OIG Recommendation #4: We recommend that the Acting Regional Administrator – FEMA Region VIII, ensure that the DHSEM conducts monitoring visits on subgrantees at least once every two years, as required.

DHSEM Response to Recommendation #4: DHSEM believes the report should provide clarification that DHSEM performed desktop monitoring of 100% of the subrecipients each quarter, and monitored 45.2 percent (33 of 73) of its subrecipient’s on site from 2012 through June 30, 2015. As previously documented, the Division’s own requirement in its Grant Guidance to subrecipients is on-site monitoring once every 36 months (2012) and 24 months (2013).

DHSEM does not believe this recommendation is consistent with the provisions of sub-recipient monitoring specified in OMB Circular A-133 and Title 2 of the Code of Federal Regulations, § 200.331(e). DHSEM will maintain a sub-recipient monitoring program that is compliant with aforementioned circular and CFR and work with FEMA Region VIII to implement recommendations for improvement, and follow-up and resolution of said recommendations. To do further on-site monitoring would violate the requirements of these regulations.

DHSEM acknowledges the remaining areas of improvement needed in monitoring and oversight. DHSEM recently implemented (effective July 1, 2015) a new sub-recipient monitoring program for all of its federal pass-through programs, EMPG included. As required by OMB Circular A-133 and Title 2 of the Code of Federal Regulations, § 200.331(e), the new program’s on-site sub-recipient monitoring is risk-based, and not based upon a certain number of visits per entity per program as the main driving factor. This new program supersedes the Division’s requirement for on-site monitoring every 24 months in its EMPG Grant Guidance.

OIG Recommendation #5: We recommend that the Acting Regional Administrator – FEMA Region VIII, ensure that the DHSEM implements a policy to follow up on and document the resolution of issues or deficiencies found during prior subgrantee monitoring visits.

DHSEM Response to Recommendation #5: DHSEM agrees with this recommendation and will follow-up, resolve and document the resolution of any recommendations from subrecipient monitoring, including recommendations / comments cited in the draft OIG report and any documented in previous EMPG on-site monitoring of subrecipients starting with the 2012 EMPG grant.

DHSEM disagrees with the OIG statement that “There was no formal review or approval of the reconciliation by DHSEM personnel to ensure it was accurate or correct.” DHSEM conducted an internal review of the data by other Finance Staff, DHSEM leadership reviewed with Finance Staff and concurred, and finally the adjusting journal entries required approval of the Controller’s Office of the Colorado Department of Public Safety. DHSEM received such approval on all final adjusting journal entries.

The Division will continue to work with the OIG and the FEMA Region VIII Acting Regional Administrator to demonstrate eligibility of the expenses involving the Emergency Preparedness Grant Program.



Team effort in Colorado targets teens, adults for Cyber Security Awareness

The numbers are staggering. On average, there are one million victims of cyber-crime across the globe every day, and most of them could have avoided the attack if they were more educated on cyber security. Add to that the annual cost of cybercrime to the world economy, which is estimated to be a whopping $445 billion*.

October’s National Cyber Security Awareness Month is designed to make a dent in those numbers by creating awareness about hackers and their techniques, and letting people know how they can protect themselves. To support that effort, Governor John Hickenlooper has also proclaimed October Cyber Security Awareness month for Colorado (see attached proclamation). The Governor’s Office of Information Technology (OIT) is teaming up with the Colorado Division of Homeland Security and Emergency Management, READYColorado, the Colorado Army National Guard and Regis University to sponsor several events geared toward educating the public about cyber security threats.

During the month of October events include:

  • Free Cyber Security information through our call-in line: Saturday, October 18th from 10:00am-6:00pm. Call 303.964.6848 or 1-800-388-2366 EXT. 6848.
  • Daily Twitter cyber security tips sent out by experts with the hashtag #CoCyberHelp
  • Community outreach at several area schools (DPS, Adams, Aurora) over the next several months. School presentations will help “tweeners” and teens understand how their social media, computer and SmartPhone use can impact their security and their privacy.
  • We have Information Security team members available for interviews on the following subjects:
  • Detection of and avoiding phishing scams: the latest phishing scams are often spread through invitations to “shared” documents. These invitations require you to input username and password and thereby give the attackers crucial information to access your personal data. They are insidiously spread through users’ contacts and often change their email content and headline to avoid detection. We’ll tell you what the red flags are and how to protect yourself if you fall victim to these attacks.
  • Keeping your home computer safe: use a firewall, scan for viruses, scan for spyware, stay up-to-date… computer updates often take care of known vulnerabilities in your computer, educate yourself (use strong passwords, know what scams to watch out for, stay abreast of latest tech news), secure your home network and mobile connection, back up, back up, back up. Make sure your most important information is saved somewhere besides your computer.
  • Using social media safely: What settings keep you the safest, what posts can put you at risk, what to consider if you have children (picture posts, location settings, etc).
  • Ways to keep your children safe online: step into their cyber world, know what their computer habits are, set house rules, teach them to protect their privacy. Make sure computer is in shared space so you know what is going on. Communication and relationship will be key to knowing when they are encountering dangers.

Please contact us if you would like to schedule an interview or if you would like to cover one of our educational presentations to students across the metro area. You can find more resources for cyber security tips at www.colorado.gov/cybersecurity/help .

*Cybercrime cost figure comes from a McAfee study cited in this Washington Post article.